MITRE ATT&CK T1070.002

Evidencestore Provides Cryptographic Proof That Deleted Log Lines Once Existed

Evidencestore is an open-source Go project that acts as an independent witness for system logs, allowing investigators to prove that specific log entries existed at a certain time even after an attacker deletes them from the source server. The system uses hash chains, Merkle trees, external timestamp authorities, and forward-secure mechanisms to create verifiable evidence packages that can be checked offline without trusting the storage operator. In a demonstration, four lines showing a root login attempt from 203.0.113.7 and subsequent malicious commands were erased using sed -i, yet the remote store retained byte-for-byte copies with cryptographic proofs. The collector component handles complex file rotation, inode tracking, and logrotate scenarios to ensure no lines are lost or renumbered. Time is anchored to RFC 3161 timestamps rather than local clocks, and signed heads can be replicated to external Object Lock storage to resist even the storage owner. The project addresses limitations of traditional SIEM systems and hash chains by enabling skeptical third-party verification.